Foxit PDF Reader EUVD-2026-42205

Exploitation requires the victim to open an attacker-crafted PDF in Foxit PDF Reader or Foxit PDF Editor with the JavaScript engine enabled (default), where the embedded script writes annotation attributes to corrupt the annotation object's internal structure; the crash manifests on the subsequent object release. Limiting factors: the attack vector is local (AV:L) and demands user interaction (UI:R) - the file must be delivered and opened - and it depends on JavaScript actions being enabled, so disabling JavaScript or refusing to open untrusted PDFs prevents it; no authentication is needed on the target (PR:N) but the attacker gains no remote-over-network access.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) describes a local, low-complexity, unauthenticated flaw that requires user interaction (opening a file) and yields high impact across all three dimensions - consistent with memory corruption that could go beyond denial of service. There is a signal conflict worth flagging: the vendor's CVSS claims C:H/I:H (implying code execution / data exposure) while Foxit's own tags label this 'Denial Of Service' and the description states only that the application crashes, so the realistic outcome may be limited to a crash unless the invalid-release primitive is proven exploitable for RCE. No EPSS score, KEV listing, SSVC decision, or POC was provided, so exploitation probability cannot be quantified from the input; the requirement that a victim open a malicious PDF with JavaScript enabled meaningfully limits mass exploitation. Net: a credible client-side risk warranting prompt patching given Foxit's large install base, but not evidenced as actively exploited or widely weaponized.

An attacker crafts a PDF containing JavaScript that writes malformed annotation attributes and emails or hosts it for download; when a victim opens the file in Foxit PDF Reader or Editor with JavaScript enabled, the corrupted annotation structure causes an invalid pointer release that crashes the application (denial of service) and could potentially be shaped into memory corruption. Because the vector is local with required user interaction (AV:L/UI:R), exploitation depends on social-engineering the target into opening the document; no public exploit code was identified at time of analysis.